]> git.zerfleddert.de Git - proxmark3-svn/blame - README.md
CHG: merged the forum user @jason 's fixes to LEGIC. *UNTESTED*
[proxmark3-svn] / README.md
CommitLineData
02b6f355 1The iceman fork
c00fc47d 2===============
883c82b5 3[![Build Status](https://travis-ci.org/iceman1001/proxmark3.svg?branch=master)](https://travis-ci.org/iceman1001/proxmark3) [![Coverity Status](https://scan.coverity.com/projects/5117/badge.svg)](https://scan.coverity.com/projects/proxmark3-iceman-fork) [![Latest release] (https://img.shields.io/github/release/iceman1001/proxmark3.svg)] (https://github.com/iceman1001/proxmark3/releases/latest)
4
8b89fcae 5##This fork is HIGHLY experimental
02b6f355 6
703ac289 7##Notice
6063655a 8There is so much in this fork, with all fixes and additions its basically the most enhanced fork to this day for the Proxmark3 device.
c0bab227 9
703ac289 10##Offical
02b6f355 11The official Proxmark repository is found here: https://github.com/Proxmark/proxmark3
12
8b89fcae 13##Coverity Scan Config & Run
b112787d 14Download the Coverity Scan Self-buld and install it.
15You will need to configure ARM-NON-EABI- Compiler for it to use:
16
17:: Configure
18cov-configure --comptype gcc --compiler /opt/devkitpro/devkitARM/bin/arm-none-eabi-gcc
19
20::run it (I'm running on Ubuntu)
c0bab227 21cov-build --dir cov-int make all
b112787d 22
23:: make a tarball
24tar czvf proxmark3.tgz cov-int
25
26:: upload it to coverity.com
27
703ac289 28##Whats changed?
6063655a 29Whats so special with this fork? I have scraped the web for different enhancements to the PM3 source code and not all of them ever found their way to the master branch.
02b6f355 30Among the stuff is
31
32 * Jonor's hf 14a raw timing patch
33 * Piwi's updates. (usually gets into the master)
34 * Piwi's "topaz" branch
35 * Piwi's "hardnested" branch
36 * Holiman's iclass, (usually gets into the master)
37 * Marshmellow's fixes (usually gets into the master)
38 * Midnitesnake's Ultralight, Ultralight-c enhancements
39 * Izsh's lf peak modification / iir-filtering
40 * Aspers's tips and tricks from inside the PM3-gui-tool, settings.xml and other stuff.
41 * My own desfire, Ultralight extras, LF T55xx enhancements, bugs fixes (filelength, hf mf commands ), TNP3xxx lua scripts, Awid26, skidata scripts (will come)
42 * other obscure patches like for the sammy-mode, (offline you know), tagidentifications, defaultkeys.
43 * Minor textual changes here and there.
44 * Simulation of Ultralight/Ntag.
6063655a 45 * Marshmellow's and my "RevEng" addon for the client. Ref: http://reveng.sourceforge.net/ Now using reveng1.31
02b6f355 46 * Someone's alternative bruteforce Mifare changes.. (you need the two other exe to make it work)
47
48 * A Bruteforce for T55XX passwords against tag.
49 * A Bruteforce for AWID 26, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a AWID Reader.
c0bab227 50 * A Bruteforce for HID, starting w a facilitycode then trying all 0xFFFF cardnumbers via simulation. To be used against a HID Reader.
b112787d 51 * Blaposts Crapto1 v3.3
c00fc47d
I
52 * Icsom's legic script and legic enhancements
53 * Aczid's bitsliced bruteforce solver in 'hf mf hardnested'
fdefe5cb 54
c00fc47d
I
55##Straight from the CHANGELOG
56=============================
ff5f9f59 57 - 'analyse lcr' - added a new main command group, to help analysing bytes & bits & nibbles. (iceman)
703ac289
I
58 - 'lf nedap' - added identification of a NEDAP tag. (iceman)
59 - 'lf viking clone' - fixed a bug. (iceman)
735a11ed 60 - Added bitsliced bruteforce solver in 'hf mf hardnested' (aczid)
92243fcb 61 - 'hf mf chk' speedup (iceman)
62 - 'hf 14a/mf sim x" attack mode, now uses also moebius version of mfkey32 to try finding the key. (iceman)
63 - 'hf 14a sim' Added emulation of Mifare cards with 10byte UID length. (iceman)
64 - 'hf mf sim' Added emulation of Mifare cards with 10byte UID length. (iceman)
6063655a 65 - Added `lf guard clone/sim` (iceman)
66 - Added `lf pyramd clone/sim` (iceman)
67 - trying to fix "hf 14b" command to be able to read CALYPSO card. (iceman)
68 - `hf legic load`, it now loads faster and a casting bug is gone. (iceman)
69 - Added `hf legic calccrc8` added a method to calculate the legic crc-8 value (iceman)
70 - `hf legic decode` fixed the output overflow bugs, better printing (iceman)
71 - Coverity Scan fixes a lot of resource leaks, etc (iceman)
72 - Added `lf presco *` commands started (iceman)
73 - Added `lf hid wiegand` added a method to calculate WIEGAND in different formats, (iceman)
74 - `hf mf chkkeys` better printing, same table output as nested, faster execution and added Adam Lauries "try to read Key B if Key A is found" (iceman)
75 - `hf mf nested` better printing and added Adam Lauries "try to read Key B if Key A is found" (iceman)
76 - `hf mf mifare` fixing the zero parity path, which doesn't got called. (iceman)
77 - Updated the @blapost's Crapto1 implementation to v3.3 (blapost)
78 - `hf mf c*` updated the calling structure and refactored of the chinese magic commands (iceman, marshmellow)
79 - Started to add Peter Fillmore's EMV fork into Iceman fork. ref: https://github.com/peterfillmore/proxmark3 (peter fillmore, iceman)
80 - Added Travis-CI automatic build integration with GitHub fork. (iceman)
81 - Updated the Reveng 1.30 sourcecode to 1.31 from Reveng projecthomepage (iceman)
82
83 - Added possibility to write direct to a Legic Prime Tag (MIM256/1024) without using values from the 'BigBuffer' -> 'hf legic writeRaw <addr> <value>' (icsom)
84 - Added possibility to decrease DCF values at address 0x05 & 0x06 on a Legic Prime Tag
85 DCF-value will be pulled from the BigBuffer (address 0x05 & 0x06) so you have to
86 load the data into the BigBuffer before with 'hf legic load <path/to/legic.dump>' & then
87 write the DCF-Values (both at once) with 'hf legic write 0x05 0x02' (icsom)
88 - Added script `legic.lua` for display and edit Data of Legic-Prime Tags (icsom)
89 - Added the experimental HITAG_S support (spenneb)
90 - Added topaz detection to `hf search` (iceman)
91 - Fixed the silent mode for 14b to be used inside 'hf search' (iceman)
92
93---
02b6f355 94Give me a hint, and I'll see if I can't merge in the stuff you have.
95
96I don't actually know how to make small pull-request to github :( and that is the number one reason for me not pushing a lot of things back to the PM3 master.
97
703ac289 98##PM3 GUI
02b6f355 99I do tend to rename and move stuff around, the official PM3-GUI from Gaucho will not work so well. *sorry*
100
703ac289 101##Development
c0bab227 102This fork now compiles just fine on
c00fc47d
I
103 - Windows/mingw environment with Qt5.3.1 & GCC 4.8
104 - Ubuntuu 1404, 1510
105 - Mac OS X (or before the hardnested BF solver at least)
c0bab227 106
703ac289 107##Setup and build for UBUNTU
c0bab227 108GC made updates to allow this to build easily on Ubuntu 14.04.2 LTS or 15.10
109See https://github.com/Proxmark/proxmark3/wiki/Ubuntu%20Linux
02b6f355 110
c0bab227 111Run
28d47dc9 112 -> sudo apt-get install p7zip git build-essential libreadline5 libreadline-dev libusb-0.1-4 libusb-dev libqt4-dev perl pkg-config wget
c0bab227 113
114Follow these instructions
28d47dc9 115Get devkitARM release 41 from SourceForge (choose either the 64/32 bit depending on your architecture, it is assumed you know how to check and recognize your architecture):
02b6f355 116
117(64-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-x86_64-linux.tar.bz2/download
118(32-bit) http://sourceforge.net/projects/devkitpro/files/devkitARM/previous/devkitARM_r41-i686-linux.tar.bz2/download
c0bab227 119
02b6f355 120Extract the contents of the .tar.bz2:
c0bab227 121 -> tar jxvf devkitARM_r41-<arch>-linux.tar.bz2
122
02b6f355 123Create a directory for the arm dev kit:
c0bab227 124 -> sudo mkdir -p /opt/devkitpro/
125
02b6f355 126Move the ARM developer kit to the newly created directory:
c0bab227 127 -> sudo mv devkitARM /opt/devkitpro/
128
02b6f355 129Add the appropriate environment variable:
c0bab227 130 -> export PATH=${PATH}:/opt/devkitpro/devkitARM/bin/
131
02b6f355 132Add the environment variable to your profile:
c0bab227 133 -> echo 'PATH=${PATH}:/opt/devkitpro/devkitARM/bin/ ' >> ~/.bashrc
134
135Clone iceman fork
136 -> git clone https://github.com/iceman1001/proxmark3.git
02b6f355 137
c0bab227 138Get the latest commits
139 -> git pull
140
141CLEAN COMPILE
142 -> make clean && make all
02b6f355 143
c0bab227 144Flash the BOOTROM
145 -> client/flasher -b /dev/ttyACM0 bootrom/obj/bootrom.elf
146
147Flash the FULLIMAGE
148 -> client/flasher /dev/ttyACM0 armsrc/obj/fullimage.elf
02b6f355 149
c0bab227 150Change into the client folder.
151 -> cd client
02b6f355 152
c0bab227 153Run the client
154 -> ./proxmark3 /dev/ttyACM0
155
703ac289 156##Homebrew (Mac OS X)
dc1c9ae4 157These instructions comes from @Chrisfu, where I got the proxmark3.rb scriptfile from.
4003623b 158Further questions about Mac & Homebrew, contact @Chrisfu (https://github.com/chrisfu/)
02b6f355 159
dc1c9ae4
I
1601. Install homebrew if you haven't yet already done so: http://brew.sh/
161
1622. Tap this repo: `brew tap iceman1001/proxmark3`
163
1643. Install Proxmark3: `brew install proxmark3` for stable release or `brew install --HEAD proxmark3` for latest non-stable from GitHub.
165
703ac289
I
166##Docker container
167I recently added a docker container on Docker HUB. You find it here: https://hub.docker.com/r/iceman1001/proxmark3/
168Follow those instructions to get it up and running. No need for the old proxspace-environment anymore.
dc1c9ae4 169
ba2e685d
I
170[1.6.0] How to start: https://www.youtube.com/watch?v=b5Zta89Cf6Q
171[1.6.0] How to connect: https://youtu.be/0ZS2t5C-caI
172[1.6.1] How to flash: https://www.youtube.com/watch?v=WXouhuGYEiw
173
174Recommendations:
175Use only container tag [1.6.1]
176
dc1c9ae4 177
8b89fcae 178##Buying a proxmark3
c0bab227 179The Proxmark 3 device is available for purchase (assembled and tested) from the following locations:
180
b82c2f85
I
181 * http://proxmark3.tictail.com/ (For buyers in EU, most likely in Sweden)
182
183 * http://www.elechouse.com/ (new and revised hardware package 2015, located in China)
02b6f355 184
c0bab227 185 I recommend you to buy this version.
02b6f355 186
c00fc47d 187
4003623b
I
188##Enjoy
189
190January 2015, Sweden
191iceman at host iuse.se
192
193
194
195
8b89fcae 196##Note from Jonathan Westhues
02b6f355 197Most of the ultra-low-volume contract assemblers could put
198something like this together with a reasonable yield. A run of around
199a dozen units is probably cost-effective. The BOM includes (possibly-
200outdated) component pricing, and everything is available from Digikey
201and the usual distributors.
202
203If you've never assembled a modern circuit board by hand, then this is
204not a good place to start. Some of the components (e.g. the crystals)
205must not be assembled with a soldering iron, and require hot air.
206
207The schematics are included; the component values given are not
208necessarily correct for all situations, but it should be possible to do
209nearly anything you would want with appropriate population options.
210
211The printed circuit board artwork is also available, as Gerbers and an
212Excellon drill file.
213
214
215LICENSING:
216
217This program is free software; you can redistribute it and/or modify
218it under the terms of the GNU General Public License as published by
219the Free Software Foundation; either version 2 of the License, or
220(at your option) any later version.
221
222This program is distributed in the hope that it will be useful,
223but WITHOUT ANY WARRANTY; without even the implied warranty of
224MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
225GNU General Public License for more details.
226
227You should have received a copy of the GNU General Public License
228along with this program; if not, write to the Free Software
229Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
230
231
232Jonathan Westhues
233user jwesthues, at host cq.cx
234
235May 2007, Cambridge MA
Impressum, Datenschutz